gc_dump_thing's code for the GCX_NAMESPACE case doesn't handle ns->prefix being null, which appears (from other code I've looked at that sets prefix to null) to be valid. I hit this running GC_MARK_DEBUG, with js_DumpGCHeap set, starting Mozilla. ns->uri in the case with null ns->prefix was "http://www.mozilla.org/microsummaries/0.1".

Comment on attachment 223822 [details] [diff] [review] patch Sure, sorry I missed this for so long. /be

These bugs are all part of a search I made for js bugs that are getting lost in transit: http://tinyurl.com/jsDeadEndBugs They all have a review+'ed, non-obsoleted patch and are not marked fixed-in-tracemonkey or checkin-needed but have not seen any activity in 300 days. Some of these got lost simply because the assignee/patch provider never requested a checkin, or just because they were forgotten about.

This was in fact fixed as part of bug 366725 http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=jsgc.c&branch=&root=/cvsroot&subdir=mozilla/js/src&command=DIFF_FRAMESET&rev1=3.204&rev2=3.205 but the code was then removed soon after.